MCP client
n8n — the case OAuth cannot serve, done properly
Wire Attensira into an n8n AI Agent workflow with the MCP Client Tool node, a static key held in n8n credentials, and a restricted tool list.
Karl-Gustav Kallasmaa, Founder & CEOLast updated What you configure
The exact settings, as our documentation publishes them.
Node: MCP Client Tool (inside an AI Agent workflow)
Endpoint: https://mcp.attensira.com/mcp
Transport: HTTP Streamable
Credential: Bearer / header auth holding atn_live_<your key>
Connecting it
In order, with the reason each step exists rather than only the instruction.
- 1
Add the MCP Client Tool node
Use the MCP Client Tool node inside an AI Agent workflow. Set the endpoint to the Attensira MCP server and the transport to HTTP Streamable — not SSE, which the server does not offer.
- 2
Store the key as an n8n credential
Choose the Bearer or header-auth credential type and put the key there rather than in the node. n8n credentials are encrypted at rest and are not written into the workflow JSON, so an exported or version-controlled workflow does not carry the key.
- 3
Restrict the tool list on the node
Once connected, the node exposes Attensira's tools to the agent. Restrict the list if you do not want an unattended agent reaching credit-spending tools such as run_automation, or destructive ones such as remove_prompt.
- 4
Scope and name the key for this workflow
Give the key the narrowest scope the workflow actually needs, and name it after the workflow. A key named for its caller can be revoked later without anybody having to work out what else might break.
What it lets you do
- Runs Attensira tools on a schedule with nobody present, which is precisely the case a browser-based OAuth flow cannot serve.
- Keeps the credential out of the workflow definition, so a workflow can be exported, reviewed or committed without carrying a secret.
- Lets you bound what an unattended agent may reach by restricting the tool list on the node rather than trusting the instruction.
What it cannot do
An integration page that lists only capabilities is an advertisement. This is the half you are evaluating.
- The server speaks Streamable HTTP only and offers no plain SSE transport, so a node configured for SSE will not connect regardless of the credential.
- A static key never expires until revoked, and revoking it breaks every caller using it. One key per workflow is what makes an individual workflow switchable off.
- Restricting the tool list bounds what the agent can call, not what the instruction asks for. An agent told to do something its tools cannot do will report failure rather than find another way.
Every other client on this list has a human sitting in front of it when it starts. n8n does not, and that single fact determines everything about how it connects.
Why the key is the right answer here
OAuth is the better credential wherever a browser can open, for reasons that are not subtle: nothing secret ends up on disk, tokens refresh silently, and revoking one client leaves the rest alone.
None of that helps a workflow that fires overnight. There is no browser, nobody to approve a prompt, and nothing to complete a sign-in. A static key is what that case requires, and it is a fully supported credential on the same endpoint rather than a legacy fallback — which is why the documentation is explicit that keys are not going anywhere.
Wiring it up
Use the MCP Client Tool node inside an AI Agent workflow. Set the endpoint to the Attensira MCP server, and set the transport to HTTP Streamable.
That transport setting is worth checking twice. The server speaks Streamable HTTP only and offers no plain SSE transport, so a node left on SSE will fail to connect regardless of whether the key is correct — and the failure will look like an authentication problem.
Keep the key in a credential, not in the node
n8n has a credential store, and using it is the whole security story here. Choose the Bearer or header-auth credential type and put the key in it. Credentials are encrypted at rest and are not written into the workflow JSON, which means a workflow can be exported, reviewed, shared or committed without carrying the secret with it.
A key inlined into the node instead travels with every copy of that workflow, and workflows get copied.
Restrict what the agent may reach
Once the node is connected it exposes Attensira's tools to the agent. Three of them spend credits and two of them permanently delete things, and the node lets you restrict which are available.
Use that. An instruction telling an agent not to run automations is a request; a tool list that omits the tool is a boundary. For a reporting workflow the read tools are usually the entire requirement, and removing everything else costs nothing and closes the most expensive failure mode an unattended agent has.
Pair it with scope. Mint the key read-only if the workflow only reads, and remember that scope cannot be widened after minting — which is a feature here, because it means the key you gave to a scheduled job cannot quietly gain the ability to delete things later.
Name keys after workflows
Revoking a key breaks every caller using it, because the key is the identity. That is the operational cost of a static credential, and there is one cheap mitigation: one key per workflow, named after the workflow.
When the workflow is retired, or when somebody wants to know whether a particular integration is still in use, the answer is a key you can revoke on its own rather than an investigation into what else might stop working.
What it is good for
Scheduled reporting is the obvious fit — a weekly pull of the analytics areas that matter, formatted and posted somewhere people read. So is monitoring: the inbox listing is free and read-only, and a job that flags rows whose occurrence count is climbing catches the one failure mode an autonomous system genuinely has, which is waiting silently for somebody to notice.
Where an unattended agent goes wrong
The failure worth designing against is not a workflow that errors — that is visible. It is a workflow that succeeds while doing slightly the wrong thing, on a schedule, for weeks. Two habits help. Pin the window in the instruction rather than leaving it to a default, so two runs a month apart are comparable. And read the session trace of an early run to confirm the agent read the slice you meant, because a fluent report about the wrong thirty days is indistinguishable from a correct one until somebody checks.
Questions people ask
- Why a static key rather than OAuth?
- Because a workflow fires at three in the morning with nobody to approve a browser prompt. That is exactly the case keys exist for, and they are fully supported rather than deprecated.
- Will the key end up in an exported workflow?
- Not if it is stored as an n8n credential. Credentials are encrypted at rest and are not written into the workflow JSON.
- Which transport setting is correct?
- HTTP Streamable. The server does not offer SSE, so a node set to SSE will not connect.
- How do I stop an automation spending credits unexpectedly?
- Restrict the tool list on the node. Removing run_automation and ask from what the agent may call is more reliable than instructing it not to use them.
- How should I name the key?
- After the workflow. Since revoking a key affects every caller using it, a key named for one workflow can be revoked without an investigation.
Sources
Every factual statement above, with the page it came from and the date that page was read.
Attensira's connect documentation instructs n8n users to set the transport to HTTP Streamable and states that the server does not offer SSE.
docs.attensira.com · retrieved
“set the endpoint to https://mcp.attensira.com/mcp and the transport to HTTP Streamable — not SSE, which the server does not offer”
Attensira's connect documentation states that n8n credentials are encrypted at rest and are not written into the workflow JSON, so an exported or version-controlled workflow does not carry the key.
docs.attensira.com · retrieved
“n8n credentials are encrypted at rest and are not written into the workflow JSON, so an exported or version-controlled workflow does not carry the key.”
Attensira's connect documentation describes n8n as exactly the case OAuth cannot serve — a workflow firing overnight with nobody to approve a browser prompt.
docs.attensira.com · retrieved
“This is exactly the case OAuth cannot serve: a workflow fires at 3am with nobody to approve a browser prompt.”